Saturday November the 17th 2009 Devnology held their first Devnology Community Day. A great day with amazing content for developers.This post gives my impressions of the day.

For people who don’t like to read just watch the slideshow.

General Impression

When you put a  group of people that all share the same interests in a room it always creates a breeding ground for discussions and sharing knowledge. If you than put these same people in a nice building, feed them and in general make sure they have nothing to complain it only gets better. I could feel this from the first minute I arrived at the community day and it lasted for the rest of the day. The only thing I possible can complain about was the lack of an internet connection. This was an unforeseen problem and will be double checked next time. Pieter Joost promised me so it must be true.

Sessions

The session where divers in content and in setting, there were workshops, presentations, Chalk ‘n Talks and Lightning talks. Topics you could choose from are in the table below.

I learned some Haskell ( Even won a book ), got an introduction to Ruby and saw some amazing Java code for Software transactional Memory.

Devnology

Devnology is a great organization that already has organized a lot of amazing meetings. A panel discussion on Model Driven development and a session with Greg Young about domain driven design are just a few of the highlights. Devnology has a mission that says it all:

Devnology aims to provide the Dutch software development community with opportunities to exchange knowledge and experience. We aim to bridge the gap between theory and practice of software development.

Most of the twitter tweets about Devnology use #devnology so you can see what people are saying over here.

Contacting and asking Devnolgy questions is easy, just follow this English contact page, they are all very involved and more than willing to answer questions.

Devnology depends on sponsors and so far they had some great sponsors. The community day was held at VXCompany in Baarn. VXCompany hosted the event very well and free charge.

Conclusion

I had a very well spent Saturday. Everything was taken care off but there also was a lot of freedom to find your way. The speakers were very involved, very easy to talk to and as far as I can assess very knowledgeable. You just have to love the organizers, the speakers and the attendees for giving up their free Saturday and making this an event to remember.

I am planning on exploring how to architect a good MVC application. During this exploration I found some interesting web-resources. I might be using this post in possible future blog posts as a reference.

Sample apps

I really think that looking at other peoples code can give you great ideas about what to do and what not. So here are some sample apps to look at. You could look at SharpArchitecture also as a sample app but I thought that one deserved a paragraph of it’s own.

• I don’t know Rob Connery personally but you gotta love what he does. StoreFront, is his sample app. And you can find a lot about it here.
• Read the separate Oxite paragraph for more details before downloading ! Oxite got a lot of bad credits but combined with the critics you can find it still has value in learning how to architect an MVC app or how not to architect an MVC app.
• NerdDinner is rather basic but still is a nice starter with a free chapter of the “Proffesional ASP.NET MVC 1.0” book coming with it.
• Codecamp server is on my list to explore, haven’t seen it yet. Is is part of the “ASP.NET MVC in Action” book.

SharpArchitecture

SharpArchitecture already has an architecture and while exploring it you can get very inspired. As far as I can tell there went a lot of thought in this architecture and for now I see it as a starting and reference point for my explorations.

You can find it here.

Oxite

When Oxite got out it got a lot of criticism, but also a lot of love to make it better. There is a lot to find in the comments about Oxite about what people expect from an MVC app.

• This tweet from Simone Chiaretta is what most people thought about Oxite when it got out.
• This post is my all-time Oxite favourite. Rob Connery gives explanations and solutions.
• Chad Myers is a good second with also constructive comments
• Although I don’t like the tone, this post still has some great comments.
• A collection of Oxite tweets

Screen casts

Most screen casts are not on an architecture level, but I do believe that the more details you know, the better you can architect the application. Also you need to be aware that these screen casts might be about different versions of the MVC framework.

• Scott Guthrie has a nice session at the Manchester user group
• Dimecast has a lot of screen casts also about SharpArchitecture
• At oredev there was an advanced MVC session
• Rob Connery has multiple screen casts about the storefront app and TDD.
• I realy like this one: ASP.NET MVC, DynamicData, Domain-/RiaServices, Unity and NHibernate: Part 1
• A lot off screen casts at the official ASP.Net site

Books

• This post by David Hayden says enough about some books, take your pick.
• This is a nice Stackoverflow answer about some books.

Miscellaneous

I just had to mention these posts, but did not have a real category for it.

• Simone Chiaretta describes the stack he uses with MVC. This gives a great overview of choices to make.
• Simone Chiaratte lists 12 ASP.NET MVC Best Practices

Other posts like this one

You wouldn’t have guessed it, but other people have collected resources too.

• The official ASP.Net site
• From the polymorphic podcast 47 resources to rock your development
• Stephen Walther on ASP.NET MVC
• Chris Bowen’s Asp.Net resource guide

I hope everybody has just as much fun as I have exploring this. If anybody has something to add, please do so in  the comments.

There once was a woodcutter working hard cutting down a tree. Suddenly a leprechaun appeared and started yelling stop stop.

The woodcutter looked at the leprechaun and started smiling : “Are you going to offer me a pot of gold if I quit cutting down your house ?”. The leprechaun frowned and replied “off course not silly, leprechauns don’t live in trees ! I live in a beach house in Miami, but I do want to make you an offer.”

The leprechaun made the following offer:

If you promise you will give half of your winnings to charity, I will let you win twenty million.

The woodcutters first thought was that he was not going to give away ten million. But thinking a bit harder he came to the conclusion that he just was offered ten million and he should accept the offer as fast as he could. So he started picturing what his wife would say when they would have won the ten million. Humm wait a minute, I won’t be able to convince my wife to give away ten million. So he asked the leprechaun if he was allowed to tell his wife about the deal. The leprechaun agreed.

If you and your wife will give half of your winnings to charity, I will let you win twenty million.

So the woodcutter started picturing again how he and his wife would celebrate the ten million tomorrow or the day after. Hummm the leprechaun did not say anything about a date. So leprechaun when is this going to happen ?. Oh sorry said the leprechaun I cannot commit to a date, it will be in your lifetime. The woodcutter thought hard and did not find this very acceptable, suppose he was already going to win twenty million, was the leprechaun going to cheat him out of ten million ? The woodcutter strongly suggested that the leprechaun would give a date, the leprechaun finally agreed.

If you and your wife will give half of your winnings to charity, I will let you win twenty million before the end of this year.

The woodcutter started imaging again about spending all those euro’s. Hummmm the leprechaun did not say anything about euro’s. So leprechaun what will the currency be ? Oh the leprechaun could not really tell, it was a matter of what lottery he could manipulate and negotiations with other leprechauns. The leprechaun and the woodcutter discussed this a bit and came to a new agreement.

If you and your wife give half of your winnings to charity, I will let you win about twenty million euro’s, remaining after being converted form the original currency, before the end of this year.

Learning from the discussion so far the woodcutter did not start imaging anything but he started analyzing the agreement and the word ‘about’ started to feel a bit funny. What would happen if it was nineteen million nine hundred thousand, would he still be required to give half ? And what charity ? He could start his own foundation for the needy woodcutter. After three days of negotiating they came to an agreement.

If you and your wife give exactly half (rounded down) of your winnings to a charity of the leprechauns choice. The leprechaun will let the woodcutter win at least twenty million euro’s, remaining after being converted from the original currency, before the thirty first of December this year at midnight. The wife will not get her own amount but she shares with the woodcutter and if anything significant changes in the made agreement the woodcutter and the leprechaun will renegotiate the agreement.

The woodcutter went home a happy man. When he got home, his wife was mad for him being late three days. After some explaining she did not like the deal, she wanted half of the ten million. The wife left the woodcutter and the woodcutter went back to the forest to renegotiate.

The wife lived happily ever after.

When making agreements consider your organization, time, cultural differences, measurability of requirements, changes in the environment, personal viewpoints and as much as you can think of. Make the choices flexible enough to last and make them fast enough so you won’t be caught by design creep. Don’t exclude any major stakeholders.

Today I went to devdays 2009 www.devdays.nl. Except from the terrible traffic it was a great day. A lot of good content and it was hard to make a choice on what session to go to.

During the sessions I made notes on my new msi netbook. It worked great and only in the last session suddenly shut down because the battery was low.  I am posting my notes as is, so if it reads a bit clunky it is because it was written in a hurry. Feel free to ask questions or add content in the comments.

The sessions I went to on day one:

• C# 4.0 / The Future of C#
• Securing ASP.NET applications
• TDD and S.O.L.I.D
• Tasks threading and parallel programming

the session for day two I will be posting later.

A small introduction for these posts you can find here.Today the first day of www.devdays.nl. the day started great with a broken Tom-tom and me taking a wrong turn in The Hague. So I missed the keynote.

First session "C# 4.0 / The Future of C#" http://tinyurl.com/qczdjs by Krishnan Subramanian. Krishnan likes to type code while presenting, so it promised to be a fun session. Krishnan starts with a history lesson:

• C# 1.0 first managed Code
• C# 2.0 Generics
• C# 3.0 LINQ
• C# 4.0 Dynamic programming

trends now in C# declarative, dynamic, concurrency

We are programming very declarative, this creates a lot of noise. Finding out what the code does can be hard. A lot of details go into the how instead of the what. Krishnan uses linq to show that linq already has less noise. His non-technical girlfriend can understand a linq query.

Krishnan says that there is room for static and dynamics languages.

When you look at hardware trends,more and more multi processors machines are getting mainstream. C# 4.0 will give more possibilities for parallel programming. Krishnan demo’s this by using a LINQ ray tracer program this program is part of the parallel extensions. To make it parallel he only uses the .asParralel keyword on a LINQ query.

The themes for C# 4.0 are

• Dynamically typed objects
• Optional and Named Parameters
• improved COM interoperability
• Co- and Contra-variance

For some parts of the programs we write statically typed objects can get in your way. For these parts you can use dynamic typed features of the DLR. The DLR provides for expression trees, dynamic dispatch and call site caching. As an example Krishnan shows ugly C# reflection to determine a type and invoking a method and compares it to JavaScript and  to c# use the dynamic keyword. The dynamic keyword is a much cleaner piece of code. In the demo he calls an iron python coded calculator form c# using the dynamic keyword. The add function can take any argument that exposes the + operator to function correctly, any argument compiles. The next demo shows writing a dynamicbag that is a child implementation of DynamicObject. In this demo he uses a dictionary that is holding the properties you can call on the object, these methods than can be added at build time from the calling code. So DynamicBag.MyCustomProp = 1 will create an entry in the dictionary the holds MyCustomProp and value 1, so this code works with some minor overriding of methods even if DynamicBag doesn’t have a property MyCustomProp.

The current way to use methods with less or more parameters is to use overloads. In C# 4.0 you have named and optional parameters. The optional parameter feature you can use by setting a default value to the parameter in the method declaration. When calling the method you can use named parameters this makes the code more readable.

For COM interop there are improvements:

• Dynamic mapping
• Optional and named parameters
• Indexed properties
• Optional ref modifier
• interop type embedding

To explain Co- variance you can look at an array of strings and putting a button in it. This is co-variant but not safe. When looking at List<String> and Ienumarble<object> these cannot be cast to each other. In C#4.0 you can now use IEnumarable<in T> and IEnumarable<out T>.

In the future it might be possible to use the compiler as a service. Your program should be able to change compile behaviour.Krishnan shows a demo of code that will compile in the C# version that will come out after C# 4.0. In this he uses a CSharpEvaluator class with which he writes a program from strings. Using this he writes a command line c# interpreter. Kewl.

A small introduction for these posts you can find here. Lunch at www.devdays.nl was well taken care of. Salmon sandwiches and plenty of them.

The next session for day 1 for me was “Attack and defence: Securing ASP.NET applications”  http://www.devdays.nl/sessies/detail.aspx?code=SEC01KB By Keith Brown. ( http://twitter.com/keithbrown42 )

As a preface Keith showed us is jojo skills, pretty impressive.

According to Keith in security you need to find a balance. You need to start by thread modelling. You can find info from P&P http://www.msdn.com/securityguidance.

tips:

1. principle of minimum privileges. Don’t use the network  service account, create your own account
2. do security in depth,  assume all input is evil. Do security validation on the server.
3. put user input quickly in strongly typed variables don’t keep them in strings to long
4. don’t use regex without ^ and $, otherwise people still can insert stuff .
5. use sql parameters , don’t concatenate input in your query.
6. don’t show complete error messages, put the in the log and give the user the possibility to correlate there error with the log.
7. using a maximum length in textboxes doesn’t help. Use server side validation

If you use validation controls you need to program them correctly. You need the check on the server side the IsValid property.

Viewstate by default gets hashed and checked on tampering. Cookies don’t get this, form login cookies do.

printf(a,b,c,d) has a big security issue (not console,writeline()) a is a control channel, the rest is a data channel. Don’t give up control of the control channel. Equal so Proces.Start(a,b) and sql.commandtext = a.

demo on sql- injection (people have automated this)

• in a search box start with a ‘ and see if you get an error (if it is a string, for a number you don’t need it.
• use ‘ or 1=1 – to get all the rows
• do ‘union select null,null,null (keep adding rows)
• replace a null with intersting stuf @@version, username, tables from table_schema
• if there is a user table, select emails and passwords and put them in an excell sheet.
• change price
• exec xp_cmdshell ‘net user hacker password /add’

Keith his anti virus software wanted to let the entire audience know that it was out of date during the presentation.

To test for XSS protection turn of validateRequest and see if your application can handle it. Web.config Demo:

• put in a textbox <h2>test<h2> see if the formatting is kept.
• put forms, JavaScript and what you want in the textbox (example change logo to Google)
• when an error page is show that get’s its message from the query string, you can use this to enhance a phishing attack.

To fix the problem sandbox the output. When getting the data out of the database use HttpUtility.HtmlEncode(data). On the input side filter the input.

get free modules and examples form pluralsight.

A small introduction for these posts you can find here. My third session was a wildcard session by Dennis Doomen on TDD and S.O.L.I.D. Even though the room wasn’t on the map and the session wasn’t on the session overview the room was packed.

People who didn’t know what inheritance is, were asked to leave.

Dennis uses a definition by Michael Feathers to define quality. You must be able to write a unit test of your code within five minutes. There are multiple principles you can use, Dennis is going to focus on some of them:

• TDD
• S.O.L.I.D

TDD is a design process, tests are your first users, tests can be documentation. If TDD hurts you are doing it wrong.

For S.O.L.I.D I say read the book by Uncle Bob Martin. Dennis gives an introduction.

In the demo Dennis an aaa template for creating unit tests.( Arrange, Act, Assert) For naming he follows a Should_When naming convention. During the demo, Resharper and RhinoMocks prove their usefulness. Make unit tests intention revealing.

An extra tip from Dennis, it is possible to decorate your unit tests with the workitem attribute, this will couple the unit test with a workitem in TFS.

The samples are posted on Dennis’s blog.

It was a nice session with enough interaction. I would like to see this talk held in a room full of none believers though but then with enough time to discuss. For a nice simple introduction to S.O.L.I.D watch the dimecast screencasts.

A small introduction for these posts you can find here. The last session of the day was by  Ingo Rammer about parallel programming in .Net 4.0.

The slides and code of this session will be under conferences on http://www.thinktecture.com/.

Multithreading vs Parallelism. Multithreading is easy, just call Thread.start(). It is primarily used to keep the ui responsive.Parallel programming is used to maximally use the cores that are available.

The ray traces sample comes form the parallel extensions.

Ingo shows a demo walking a large tree structure and visualizing this. The first version uses no threading and takes about 1500 ms to complete. In the second version he tries to make a thread for every node. This version blows up, every thread takes up one mb of memory. The third version uses Threadpool.QueueUeserWorkitem, timing is off now because the threads are fire and forget. The fourth version works with the new tasks from the parallel extensions. This version does the work in about 800ms.

More functionality of the Task is making the creation possible using a factory (shorter, cleaner code). Also the results of a task can be simply used, all synchronization is done for you. In the demo he sums up all values in the tree without having to worry about synchronisation.

After that my netbook just closed down. Basically Ingo covered three ways to do parallel programming in C# 4.0.

• Fine-Grained Parallelism: Task-API and coordination structures (the foundation of it all)
• Structured Parallelism: Parallel
• Declarative Parallelism: PLINQ

Ingo is a great speaker and made this last session while everybody was tired still fun.

For developers who  don’t know, SharpDevelop is a great free IDE for developing .Net framework applications. SharpDevelop is comparable to the express editions of Visual Studio. So since they are comparable, I will compare them in this post.

On februari the 10th 2009 sharpdevelop 3.0 was released, you can download it here. The version before this one was 2.2 and was released on the 8th of august of 2007, that is a long gap. I thought that SharpDevelop was dead. The 3.0 version shows that it is alive and kicking.
The visual studio express editions are also great. Just the idea of giving away a free IDE to starting developers or just developers who can’t or will not pay for the full editions  of Visual Studio is magnificent. The express editions can be found here

First Impressions
When you spent a lot of time in Visual Studio, starting up the express editions will make you feel right at home. Everything is where you think it is. Stating SharpDevelop will make you feel a bid off. It is like someone has build a new house, redecorated it and made it look like your own house, but you know it isn’t. Still once you see there is enough beer in the fridge and have found the remote , you can have lot of fun in the new house also.

Spoiled by Resharper
In my normal development I am totally spoiled by Resharper. These IDE’s don’t support Resharper. How easy are they to use without Resharper.
Renaming a class with Resharper  also renames the file that the class is in, if you want it to. Resharper also renames all references to your renamed class and even gives you a change to change them in comments AND strings. SharpDevelop does not rename the file directly but if it detects that the class and filename are different it gives you the option to rename the file from right clicking the class name. SharpDevelop does also rename all references but does not look at comments by default. The Express Editions give the option to rename also in comments OR strings, it does not rename the filename.

When I use a class that is in the same solution but in another project Resharper gives me the option to reference the project and insert a using statement with a single shortcut. After making a reference in SharpDevelop and the Express Editions by hand you can add the using statement with a right and left click.

In general neither wins, only Resharper wins.

Add Ins and external tools
The express editions let you define your own external tools, so you can startup notepad or ildasm from your IDE and pass in parameters from your IDE. SharpDevelop lets you do the same but by default has already defined some of them. Extra to this SharpDevelop has a Regular Expression Toolkit a resource toolkit, support for subversion, FXCop and stylecop. I can see a lot more of these add- ins for SharpDevelop being developed. The express editions don’t have and probably never will have these possibilities because , and I quote :” We made a business decision to not allow 3rd party extensibility in Express.” From this post.

SharpDevelop wins this one easily.

Targeting .net frameworks
Both IDE’s by default target .net Framework 3.5 but also support 3.0 and 2.0. In addition SharpDevelop supports compact framework 3.5 and 2.0.

Another point for SharpDevelop.

Web Development
This one makes me a little sad. SharpDevelop just fails short to the “visual web developer express edition”. The express edition has a graphical designer for the pages, split screen functionality, javascript debugging possibilities and his build in web server. SharpDevelop has not.

A big win for the express editions.

Little Annoyances
The express editions don’t support solution folders, luckily SharpDevelop does.
If you want to combine a console or windows forms application with a web application or web service in a single solution the express edition don’t support this,  SharpDevelop does.

Two point for SharpDevelop.

Conlusion
If I have to choose for web applications than the express edition wins easily. The build in webserver, the graphical designer with split screen functionality and javascript debugging just make it too good.
If you think you really need to work with a database from within the IDE than also SharpDevelop is not for you. If you want to create a windows forms or console application both will work fine, if you want to build these applications more seriously and use a source control system, static code analysis and stylecop from the IDE you need SharpDevelop !

If the express editions would allow third party extensibility (Resharper) and solve my little annoyances,  it would be number one.
If SharpDevelop would get a resharper add-in, a graphical designer for web pages and a build in web server, it would be number one.

Feature Table
Matt Ward did a comparison of SharpDevelop 2.1 and the Express Editions at that time here. I stole his table and reevaluated. Thanks Matt I hope you don’t mind. The result is shown below:

Twitter is fun, and there are a lot of interesting people. Most of them are pretty open for discussion and just having fun. A lot of these people have interesting stuff to say and are willing to answer questions.

A few days now I watched crazeegeekchick make santahats for almost everybody she knows, I guess she is up to about fifty hats now. I asked her to also make a hat for my son, she did without asking any questions. Threw in a hat for me also and gave a nice compliment. Awesome !

crazeegeekchick thanks ! You are one of the people making Twitter fun.